Subject: Re: [EAI] SPF, DKIM, etc., and EAI (was: Re: IDN domains and EAI)

From: John C Klensin <[email-masked]>
Date: Fri, 09 May 2014 14:47:26 -0400

--On Friday, 09 May, 2014 15:58 +0200 Claudio Allocchio
<[email-masked]> wrote:

>...
> Maybe it is time to consider an informational report about the
> status of SPF and DKIM (and similar) techniques deplyoment,
> and their pro/cons in the global messaging scenario... and to
> take after that some decisions, too.

Speaking personally and with my "former co-chair" hat very much
off, I would favor such an effort, especially if it took a
specific look at relationships to EAI itself, message submission
issues, post-delivery mail access (e.g., POP, IMAP, and various
webmail flavors) and so on in both legacy and EAI contexts. If
such an effort carefully examined the standards involved and
concluded that, as Barry suggests, there are no conflicts,
having that written down would help to eliminate a lot of
misunderstandings and grumbling.  By contrast, if that were not
the case and the IETF were going to approve standards or promote
external work that (accidentally or with observations about
"collateral damage") impedes the deployment of either either
long-deployed practices or other work approved or promoted by
the IETF, the fact that has been done and the reasons for it
should at least be publicly documented with IETF consensus about
the reasons.

Barry and Pete, partially for the reasons below, I'd see this
more as an ad hoc committee effort, possibly including some
appointed experts, and responsible to either you or the IAB i18n
Program.

As a further observation about Barry's remarks on the subject,
there may also be a communication problem within the IETF.
Barry wrote:

> 2. We (DKIM) decided that we were OK, and that the EAI WG
> should have a second look and document issues there

Putting my "former chair" hat back on, I don't know when that
occurred, but I don't recall getting such a request during my
term as EAI Co-Chair.  Had I gotten it, I would have pointed out
that EAI almost certainly did not have the expertise needed to
do that evaluation and "document issues".  Noting the presumed
reasons that may have resulted in the assignment of DKIM to the
security area, even without the issues that Barry politely
refers to as "running out of energy", the amount of expertise in
EAI, as a WG even at its peak, for evaluation of the effects of
a system that is dependent on the DNS, the interactions between
the DNS and various email systems and protocols, and the
workings of digital signatures was very small to non-existent.
To take as an example part of the issue that caused me to make
the comment that started this thread, there were a few people
who happened to understand, partially via history with IDNA and
digital signatures, the importance of carefully-specified
canonical forms and interpretation and checking rules anytime
one is going to do a signature over something that is going to
be emailed, and who happened to also participate in EAI.  But
getting the EAI WG to understand those issues to the point of
being able to do an evaluation, or even to reach meaningful
consensus on such an evaluation, would have been a terrible
diversion -- many of the people on this list will remember that
we had problems even getting the vast majority of this WG up to
speed on the interactions between SMTP and  the i18n issues.

I vaguely recall (Joseph, Harald, XiaoDong, and others will need
to check me on this) that there was even a brief discussion of
the DKIM and SPF issues in EAI and the conclusion was that they
were both out of scope and out of competence.

So I suggest that we had either some miscommunication about
expectations, a problem with capabilities, or both, that
resulted in inadequate review.  I believe the IESG would be well
advised to figure out a way to avoid those sorts of disconnects
in the future when work with the potential for interaction
occurs in parallel, especially in different Areas.

This isn't something that EAI can drive, both because there is
no longer a WG and because the scope and required expertise are,
as noted above, much broader.  But participants in this work who
either care about either the impacts from other efforts on EAI
deployment or the broader issues should probably start making
those positions known to the Apps Area generally.   If other
mechanisms and ways to raise concerns fail, appeals of decisions
that could  introduce further conflicts (at charter time as well
as Last Call) may be appropriate to focus community attention on
the issues.

Further discussion of the general issues should probably be
moved to Apps-Discuss (if that occurs, let me know and I'll
temporarily resubscribe :-( ).

   john